Craft CMS allows a low‑privileged authenticated user to move entries into sections where they only have read access because the move‑to‑section endpoint checks only view permission instead of requiring the higher‑level save permission. This flaw lets the attacker inject content into protected sections, disrupting editorial boundaries, approval workflows, and section‑specific business logic without any elevated privileges. The weakness corresponds to CWE‑284. The vulnerability scores a medium CVSS score of 6, has an EPSS score of < 1%, indicating a very low likelihood of exploitation, and is not present in the CISA KEV catalog. The attack requires an authenticated control‑panel user with permission to move an entry, but not to save entries, and knowledge of target section identifiers. Exploitation could be carried out through the CMS web interface, causing unauthorized content placement and potential integrity and confidentiality breaches of protected sections.

Craft CMS, versions 5.0.0‑RC1 up to (but not including) 5.9.21.

The risk for exposed systems is moderate due to a CVSS score of 6, yet the EPSS score of less than 1% suggests that exploitation is currently rare. Because the flaw permits a low‑privileged authenticated user to override section‑level write restrictions, the impact involves potential integrity violations by inserting unauthorized content into protected sections and disrupting editorial processes. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path would involve an attacker logging into the control panel, selecting an entry they can move, and invoking the move endpoint with a target section identifier that they can only view. No external network privilege escalation is required, so the attack vector is limited to authenticated web access within the CMS.